using a string in php into a mysql database

Question

I am getting a string using PHP and then trying to put it into my database(mySql). I keep getting an error

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'material )' at line 1.

Here is my code. I printed out the statement in php and that is correct.

$description=$_POST["textField4"];

$description= addslashes($description);//found these two line using google
$description = mysql_real_escape_string($description);//neither seem to help.


$sql="INSERT INTO budget8000 (categories,subCategory, amount, date, description)
VALUES ($category,$subCategory, $amount, curdate(), $description )";

@sdleidhssirhc, you don't have to, but it's a SQL-injection hole if you don't! — Johan
– Johan, Commented Aug 28, 2011 at 20:45
Which of the variables ($category, $subCategory, $description) contains word "material" when the error happens? — ain
– ain, Commented Aug 28, 2011 at 20:48
From the error message the problem seems to be "material )"... it looks like you haven't quoted / escaped it correctly. — Ben
– Ben, Commented Aug 28, 2011 at 20:51

Community · Accepted Answer · 2017-05-23 11:55:45Z

2

The proper way to do this is:

$description=mysql_real_escape_string($_POST["textField4"]);
...
//and so on for each an every field that you $_GET or $_POST.

$sql= "INSERT INTO budget8000 (categories,subCategory, amount, date, description)
VALUES ('$category','$subCategory', '$amount', curdate(), '$description' )";
//      ^         ^ these quotes are vital to prevent SQL-injection and errors.
// without them mysql_real_escape_string will not work!

See: How does the SQL injection from the "Bobby Tables" XKCD comic work?

edited May 23, 2017 at 11:55

CommunityBot

11 silver badge

answered Aug 28, 2011 at 20:47

Johan

77.3k28 gold badges203 silver badges345 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Your Common Sense Over a year ago

As a matter of fact, it's part of SQL syntax. So, these quotes vital to prevent syntax errors, not injections.

Johan Over a year ago

@Col, welcome back; as always you are correct, But I find it easier to remember that it is to prevent SQL-injection AND errors, because without the quotes the code may work, but you can be 100% sure that you are at risk of SQL-injection pwn-age.

Mindfulgeek · Accepted Answer · 2011-08-28 20:49:18Z

-1

You need to use the php function mysql_real_escape_string()

$description = mysql_real_escape_string($description);

PHP documention for mysql_real_escape_string

answered Aug 28, 2011 at 20:49

Mindfulgeek

1394 bronze badges

2 Comments

Johan Over a year ago

the OP has already done, that. But using mres is not enough, you need to ALSO quote all the injected vars.

Johan Over a year ago

I didn't downvote, but that's exactly why. You did not answer the question, the OP already uses mysql_real_escape_string (incorrectly, but that's beside the point), and the error is not caused by mres. It is caused by not quoting the injected vars.

Collectives™ on Stack Overflow

using a string in php into a mysql database

2 Answers 2

2 Comments

2 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

2 Comments

Linked

Related